🦖Day 4 of the @velocidex #velociraptor #ArtifactsOfAutumn series
Artifact: 'Windows.System.Services'
Link: docs.velociraptor.app/artifact_refer…
One might use this artifact to generate a baseline of normal Windows services, and look for services out of the ordinary. We can filter on display/service name, as well as DLL, path, etc. We can also calculate hashes and provide signing info for associated executables/DLLs.
Sorting on the 'Created' column shows the most recently created services (assuming no other manipulation, etc.). Here, we see a service named 'win32times', similar to the native Windows Time Service. We also see 'evilscript.ps1' being called by 'cmd', and no signing info.🦹🔍
Adversaries may attempt to give services/tasks names that are similar or identical to those of legitimate ones make it appear legitimate or benign (T1036.004).
From here, we could dive into 'evilscript.ps1' and/or other associated activity using other artifacts and techniques.
That's it for now. Stay tuned to learn about more artifacts! 🦖
Share this Scrolly Tale with your friends.
A Scrolly Tale is a new way to read Twitter threads with a more visually immersive experience.
Discover more beautiful Scrolly Tales like this.